Health Record Policies

You work in a health information management department for an outpatient clinic. Your manager is revising the policy and procedural manuals for the department and is particularly interested in confirming that policies are in compliance with state law and Health Insurance Portability and Accountability Act (HIPAA) Privacy Law. Your manager asked you to review several policies and to review state code as they apply to HIPAA Law.

Your manager left the following two policies on your desk for review:

Release of Information: Shadow Chart Policy

“A shadow chart is a duplicate health record kept for the convenience of the medical provider. In the event that an authorized individual requests health information pertaining to a specific episode of care, health information management staff will review any shadow charts kept by medical providers for that patient to determine if any such shadow charts contain information related to the episode of care. If the shadow chart contains information related to the episode of care and is not found in the electronic record, the information from the shadow chart will also be copied, in addition to requested information found in the electronic record.”

Your supervisor left a note that this policy needs an addendum.

Information Security: Workstation Policy

“Employees are required to secure their personal workstations when not in use. Confidential health information must not be displayed on computer screens unless the employee is performing work functions on the computer and using the information. Employees may not access another employee’s computer while it is in use nor may employees use another’s password for any reason. Violation of this policy will result in disciplinary action, and depending upon nature of violation, termination may result.”

Montana Code

You now move on to review several